lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 16 Aug 2020 20:34:47 +0800 From: Ying Xue <ying.xue@...driver.com> To: Cong Wang <xiyou.wangcong@...il.com>, netdev@...r.kernel.org Cc: syzbot+0e7181deafa7e0b79923@...kaller.appspotmail.com, Jon Maloy <jmaloy@...hat.com>, Richard Alpe <richard.alpe@...csson.com> Subject: Re: [Patch net] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() On 8/16/20 7:29 AM, Cong Wang wrote: > __tipc_nl_compat_dumpit() has two callers, and it expects them to > pass a valid nlmsghdr via arg->data. This header is artificial and > crafted just for __tipc_nl_compat_dumpit(). > > tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well > as some nested attribute, TIPC_NLA_SOCK. But the other caller > tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized > on this call path. > > Fix this by just adding a similar nlmsghdr without any payload in > tipc_nl_compat_dumpit(). > > This bug exists since day 1, but the recent commit 6ea67769ff33 > ("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it > easier to appear. > > Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@...kaller.appspotmail.com > Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat") > Cc: Jon Maloy <jmaloy@...hat.com> > Cc: Ying Xue <ying.xue@...driver.com> > Cc: Richard Alpe <richard.alpe@...csson.com> > Signed-off-by: Cong Wang <xiyou.wangcong@...il.com> Good finding and thanks to fix it! Acked-by: Ying Xue <ying.xue@...driver.com> > --- > net/tipc/netlink_compat.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > > diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c > index 217516357ef2..90e3c70a91ad 100644 > --- a/net/tipc/netlink_compat.c > +++ b/net/tipc/netlink_compat.c > @@ -275,8 +275,9 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, > static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, > struct tipc_nl_compat_msg *msg) > { > - int err; > + struct nlmsghdr *nlh; > struct sk_buff *arg; > + int err; > > if (msg->req_type && (!msg->req_size || > !TLV_CHECK_TYPE(msg->req, msg->req_type))) > @@ -305,6 +306,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, > return -ENOMEM; > } > > + nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI); > + if (!nlh) { > + kfree_skb(arg); > + kfree_skb(msg->rep); > + msg->rep = NULL; > + return -EMSGSIZE; > + } > + nlmsg_end(arg, nlh); > + > err = __tipc_nl_compat_dumpit(cmd, msg, arg); > if (err) { > kfree_skb(msg->rep); >
Powered by blists - more mailing lists